Idelto

Cryptocurrency news website

Privacy & security

CipherTrace Unveils Travel Rule Protocol for Cryptocurrency Businesses

by

Blockchain security firm CipherTrace has formally announced the release of its Travel Rule Information Sharing Architecture (TRISA); a new way for cryptocurrency businesses to satisfy regulatory pressure to enforce the travel rule, which requires financial institutions to share information of fund transfers.

TRISA is described as a reference implementation that can be integrated into cryptocurrency exchanges and wallet provides, provided for free as open-source software. Additional authentication, revocation or security services can then be purchased from CipherTrace or another provider. More details about how it works technically can be found in its white paper.

Growing Pressure for a Cryptocurrency Travel Rule

CipherTrace’s TRISA protocol comes as pressure has been building for cryptocurrency businesses to comply with the travel rule and it isn’t the firm’s first bid to bolster compliance. After the Financial Action Task Force (FATF) finalized recent recommended guidelines for cryptocurrency exchanges, which included information sharing similar to that called for by the travel rule, CipherTrace partnered with Shyft to unveil a new ID protection system in July 2019.

Dave Jevans, CipherTrace’s founder and CEO, detailed how TRISA builds on some of the previous work that CipherTrace has done. 

“[TRISA is] a foundational layer that will set up the trust relationships between VASPs [virtual asset service providers], manage the encryption keys and confidentially exchange travel rule data,” he told Bitcoin Magazine. “It is about secure, reliable delivery of PII [personally identifiable information] to the correct VASP, which eliminates a huge risk for exchanges.”

In addition to framing TRISA as a way to protect privacy while complying with regulations, Jevans pointed out that Shyft will “contribute privacy-preserving features to enable compliance with GDPR and other privacy regimes” as it is implemented.

Privacy-Preserving Cryptocurrency Travel Rule Compliance

The FATF’s recommendations would make it necessary for all VASPs to share and store both sender and receiver data for all cryptocurrency transactions, and TRISA aims to make connections between these VASPs more secure. 

“TRISA is about confidentiality and ensuring reliable delivery of transaction information,” Jevans said. “The reference implementation relies on the VASPs to secure the data in their possession — i.e., ‘at rest.’ It guards against information leaks by using TLS 1.3 with forward privacy to encrypt data in transit.”

The company’s announcement of the protocol notes that Binance is already looking at TRISA as a solution for FATF compliance. 

“We have witnessed significant interest from large VASPs in the G20 countries,” Jevans said, adding that CipherTrace “hope[s] to have several major exchanges participate in the upcoming proof of concept and interoperability testing.”

The post CipherTrace Unveils Travel Rule Protocol for Cryptocurrency Businesses appeared first on Bitcoin Magazine.

Hardware Wallets Just Got a Bit More Secure With Trezor’s Shamir Backups

by

If hardware wallets have one Achilles’ heel, recovery seeds may be it. But Trezor’s SatoshiLabs has figured out a solution.

Hardware wallets are generally considered to be among the most secure solutions for storing bitcoin. As the private keys to sign transactions never leave the device, these keys are never exposed to the internet and can, therefore, not be hacked remotely. Even with physical access to the device, subtracting the keys is no straightforward job — if it’s possible at all. (This appears to be an ongoing cat-and-mouse game between security researchers.)

But even if we assume that they are secure, hardware wallets can still break, get lost, get stolen or become otherwise unusable. For these cases, users should keep a backup seed: a list of a couple of dozen words typically written down on a piece of paper, from which all the device’s private keys can be generated.

But what if the backup seed itself gets lost or — worse — stolen? 

A New Way to Split Backup Seeds

A chain is only as strong as its weakest link, and a hardware wallet is only as secure as its backup seed. If the piece of paper is stolen, the thief can claim all the coins on the hardware wallet — without any advanced technical skills. If the backup seed is lost, it is, of course, of no help when the hardware wallet is also lost, stolen or destroyed — and the coins would be inaccessible forever.

After more than a year of development, Prague-based SatoshiLabs, the company behind the Trezor hardware wallet, has now introduced Shamir Backups. Based on Shamir’s Secret Sharing, a cryptographic algorithm created by well-known cryptographer Adi Shamir (the “S” in RSA, one of the first public key cryptosystems), Shamir Backups let users “split up” their backup seeds into several word lists or “shares.” The wallet’s private keys can then be recovered by combining some predetermined subset of the shares. SatoshiLabs’ Shamir Backups allow for the creation of up to 16 shares (and individual shares can be even further divided into sub-shares).

As a practical example, you could set up a two-out-of-three backup. In that case, you would generate three different word lists, and you would need any two of the three to restore your private keys. This way, you could, for example, distribute the three lists over three different locations, minimizing the risk that two of them are lost (say, in a fire) or stolen. 

If an attacker manages to steal only one of three backup seeds, it would be of no use to them at all (as opposed to cutting a normal backup seed into multiple pieces; stealing some of these pieces could enable an attacker to guess or brute-force the remaining words). Meanwhile, if only one of the three shares is lost, the remaining two can be used to restore the wallet.

Open Standard

Shamir Backups are available for SatoshiLabs’ Trezor Model T, the company’s latest hardware wallet. Users who already have a Trezor Model T can opt to migrate to a Shamir Backup using this guide. New users can follow the regular setup guide. As an open standard (SatoshiLabs Improvement Proposal 0039), other wallet providers could opt to follow in SatoshiLabs’ footsteps and offer Shamir Backups down the road as well.

For more information on Shamir Backups, also see SatoshiLabs’ blog post announcing the solution and its additional detailed guide.

The post Hardware Wallets Just Got a Bit More Secure With Trezor’s Shamir Backups appeared first on Bitcoin Magazine.

Bitcoin Magazine’s Week in Review: Bitcoin in Focus

by

This week saw another twist in the Craig Wright saga, LocalBitcoins move away from anonymous trading with its new KYC/AML requirements, Shopify welcome the Lightning Network and Chainalysis assert that not as many bitcoin as some people think are connected to illicit services.

Craig Wright Suffers Loss

Craig Wright, one of the most infamous names in crypto, has been embroiled in a high-profile legal case for the last 30 months with the estate of his deceased business partner David Kleiman. 

In the wake of several court filings, things took a rather dicey turn for the self-proclaimed Satoshi Nakamoto. Wright was ordered by a federal judge to turn over half of the bitcoin he held prior to 2014 to the plaintiff, Ira Kleiman, the brother of David Kleiman. If Wright actually holds the BTC he says he does, this would reportedly be worth around $10 billion.

Chainalysis Decodes the Difference Between Crypto Mixers and Criminals

There has been some controversy about the role of cryptocurrency mixing services over the years, with many believing that they serve as a tool for criminals that want to evade authorities. 

However, blockchain startup Chainalysis has brought some clarity to that question. In a report titled “Cryptocurrency Typologies: What You Should Know About Who’s Who on the Blockchains,” Chainalysis found that about 8 percent of the mixed coins are actually stolen, while only 3 percent have been used on the dark web. It added that almost half of all mixed coins are sent from exchanges — 40 percent from traditional exchanges, and 7.7 percent from peer-to-peer exchanges. 

Shopify Merchants Can Now Offer Lightning Payments

Shopify is the latest online platform to provide integration for Lightning payments. The e-commerce platform announced that it is now featuring a plugin for the Lightning Network for its merchants. 

The Lightning integration was done in conjunction with OpenNode. While Shopify has been providing on-chain payments with support from BitPay, the OpenNode partnership provides merchants with the ability to receive cheap and fast Lightning payments. 

Speaking with Bitcoin Magazine, OpenNode CEO Afnan Rahman said, “Other payment processors have failed to provide a smooth experience for both the customers and the businesses using them and we intend to improve the overall experience.”

The Bitcoin Market Cap in the Spotlight

Bitcoin may lead the cryptocurrency field in market cap, but how does this asset stack up against others in the world? A new infographic from Bitcoin Magazine puts bitcoin’s market cap into perspective.

The infographic shows that bitcoin still pales in comparison to traditional asset classes like the global real-estate market and gold. 

LocalBitcoins Announces New KYC Requirements

LocalBitcoins, a popular peer-to-peer bitcoin exchange, has announced that it would extend its KYC/AML requirements to users based on their trading activity on the platform. This move is expected to affect users’ privacy significantly.

The exchange entered into an agreement with identity verification technology provider Onfido, while also establishing a new account tier system. Essentially, users will need to provide specific data about themselves depending on how much they trade each year on the exchange.

The post Bitcoin Magazine’s Week in Review: Bitcoin in Focus appeared first on Bitcoin Magazine.

LocalBitcoins’ New KYC Rules Raise Privacy Concerns

by

Beginning September 1, 2019, legacy peer-to-peer bitcoin exchange LocalBitcoins will extend its know-your-customer/anti-money laundering (KYC/AML) requirements and, as a consequence, limit user ability to retain privacy. 

According to an official blog post published on June 18, 2019, the exchange has teamed up with identity verification technology provider Onfido, and a new account tier system will be established. Depending on the amount a user trades each year on the exchange, they will have to provide specific data regarding their identity.

For instance, somebody who trades less than $1,109 (1,000 euro) in a year will have to provide their full name, country of residence, email address and phone number. A user who trades beyond this threshold will be required to provide ID verification and full KYC info. Furthermore, proof of residence and additional ID verification will become compulsory for anyone who trades bitcoin worth more than $22,180 (20,000 euros) per year.

Losing Privacy at LocalBitcoins

Earlier this year, LocalBitcoins also removed offers for in-person cash trades and enforced its first batch of KYC requirements. 

The new measures at LocalBitcoins, which is based in Helsinki, stem from Finland’s Act on Virtual Currency Service Providers, which comes into full effect in November 2019. 

In its early days, the Finnish exchange was a pioneer in its field, empowering individuals to make pseudonymous bitcoin-to-fiat trades. More recently, it’s been reported that Venezuelans used the peer-to-peer service to trade almost 20 billion bolívars in July 2019 alone as a salvation from their own crumbling fiat economy. In the context of these new KYC/AML additions, it’s very likely that people in countries with authoritarian regimes will no longer have access to services — or will have to limit their trades to amounts less than 1,000 euros per year.

The Decentralized Exchange Perspective on AML/KYC

As such, it’s fair to ask if LocalBitcoins still truly qualifies as a “decentralized exchange.” To answer the question, we spoke with representatives from Hodl Hodl, a peer-to-peer bitcoin exchange that has worked to maintain access for Iranian investors even as they have been excluded from LocalBitcoins, and Bisq, a decentralized bitcoin exchange that recently launched the space’s first DAO. LocalBitcoins did not respond to multiple requests for comment.

“LocalBitcoins has never been a decentralized exchange, because user funds have always been stored in their wallets,” Hodl Hodl CEO Max Keidun told Bitcoin Magazine.

A Bisq contributor who requested anonymity largely agreed, adding a little more context. They told Bitcoin Magazine:

“Decentralization has become a buzzword which tends to contribute more noise than signal in a sentence. The only way I can see LocalBitcoins being ‘decentralized’ is in its sourcing of offers, since they come from many people who are not a part of the LocalBitcoins company (as opposed to a single order book maintained by the company). However, that’s really no different from the way Facebook and Twitter source their media, and calling them ‘decentralized social media’ would be ridiculous.”

The two representatives were also asked why privacy matters and to what extent KYC/AML data collection can be a honeypot for user information. 

“In the digital age, data privacy matters a lot,” Keidun said. “If you take a look at the recent Binance leak of KYC/AML data, you will realize that it’s harmful for users to have their personal data (such as ID, photos, addresses) publicly available. I think it’s also dangerous because if your data is leaked from a cryptocurrency exchange then you might deal with a lot of bad actors who assume you may own a lot of bitcoins. The KYC data often includes proof of residency, so thieves can simply come to your place and try to steal something from you or harm you in other ways.”

Again, the two exchange spokespeople saw eye to eye, as the Bisq representative outlined similar concerns around data privacy:

“Data privacy is everything. It allows a user to maintain control over their property. Isn’t that part of what Bitcoin is all about? We spend so much effort on ‘not your keys, not your coins’ but not on ‘not your machine, not your control.’ In general, data privacy enables people to keep potentially great ideas alive when those in charge are wrong, so that the rest of humanity may prosper when the time for those ideas has come. Without data privacy, Bitcoin could never reach its potential.”

Finally, we asked the two exchange representatives to answer the question “Are KYC/AML-compliant exchanges data honeypots?”

Keidun answered in the affirmative.

“Many exchanges are more concerned about securely stored assets that they neglect the ethical and safe storage of KYC/AML documents,” he said. “I think KYC is a honeypot for user information and there’s nothing you can do about that as a user.”

To illustrate his point, Hodl Hodl’s CEO pointed to a rising trend in hacks through which bad actors obtain personal information instead of funds.

“Hackers have figured out that they can blackmail exchanges with the confidential KYC/AML data they steal, and ultimately this is detrimental for both the user and the exchange itself,” he continued. “If providing personal data was optional on these services, then I’m sure that 99.9 percent of users would avoid filling in any form.”

The Bisq representative indicated a similar pessimism around the safety of user data on exchanges.

“Whatever can get hacked will get hacked if there’s a sufficient motive, and the only asset that is perhaps more valuable than a whole lot of bitcoin is a honeypot of data about people who own a whole lot of bitcoin,” they explained. “For customers, not only is there the potential of identity theft, but extortion, physical harm and who knows what else. Why take the chance?”

While LocalBitcoins embraces a stricter set of KYC/AML rules that are enforced by its jurisdiction, Hodl Hodl and Bisq remain alternatives that don’t collect such data and aim to maximize users’ financial sovereignty. For now, bitcoin traders who want to maintain a level of pseudonymity will have to consider them as alternatives to LocalBitcoins.

The post LocalBitcoins’ New KYC Rules Raise Privacy Concerns appeared first on Bitcoin Magazine.

Trade Association Proposes Code of Practice for Singapore Cryptocurrency Industry

by

The Association of Cryptocurrency Enterprises and Startups, Singapore (ACCESS) has released a draft version of an industry code of practice targeted at cryptocurrency participants operating in Singapore, including exchange operators, payment and remittance services firms, cryptocurrency custodians and blockchain network infrastructure service providers.

The code of practice aims to set out standards of good practice regarding anti-money laundering and countering the financing of terrorism (AML/CFT) measures for crypto firms to comply with on a voluntary basis. 

“In essence, the code of practice helps banks and industry players to sieve out the ‘bad,’ so that quality licensed blockchain and crypto-asset businesses can grow here in a bigger way and make a stronger imprint on the global stage,” Anson Zeall, the chairman of ACCESS, said in a press release on August 13, 2019.

Adding SPICE to Crypto Practices 

The code of practice is part of ACCESS’s broader, industry-driven Standardisation of Practice in Crypto Entities (SPICE) initiative, which aims to formulate and promote industry best practices. 

SPICE is being facilitated by the Monetary Authority of Singapore (MAS) and developed in consultation with the Association of Banks in Singapore (ABS). 

To further the SPICE initiative, ACCESS said it is also working with industry leaders to provide practical guidance around best practices for numerous cryptocurrency exchanges based in Singapore. The working group is co-led by cryptocurrency exchange Luno and includes Paxos, Quoine and Xfers. 

Sopnendu Mohanty, the chief fintech officer of MAS, said the regulator welcomes the industry’s collaborative effort to develop guidance that helps banks and cryptocurrency/blockchain startups strengthen regulatory compliance. 

“The challenge for regulators has been to harness the potential benefits of blockchain technology and crypto tokens while ensuring that the risks are contained,” Mohanty said. “This industry collaboration will help to promulgate good practices for fintech players and financial institutions to manage risks such as money laundering and terrorism financing in crypto and blockchain [technology], and set the foundation for further technical development and broader industry adoption of innovative technologies.”

Code Specifics

Among the measures recommended, the code advises cryptocurrency companies to assess the AML/CFT risks arising from their activities and clientele. This includes consideration of customer risk, geographical risk and business risk.

Assessing customer risk means, for instance, considering the complexity of a business’s ownership structure, whether they are a cash-intensive business, and if they will be making high volumes of transactions and/or regular transactions of high value. 

Geographical risk requires evaluating factors such as where a company’s customers are located, as well as the origin and destination of transactions. 

Finally, mitigating business risk involves taking into account whether or not a business is spread across multiple jurisdictions, the nature and complexity of a company’s products or services, and if the business has a heavy reliance on third parties to distribute its products, among other factors. 

Depending on the assessed customer risk, crypto companies should apply the appropriate level of customer due diligence measures, the code says. 

It recommends the establishment of an internal AML/CFT policy that addresses the main areas of AML/CFT compliance, including customer due diligence, transaction monitoring and suspicious transaction reporting. 

Furthermore, it prescribes that cryptocurrency companies should designate an AML/CFT compliance officer and also put in place systems to monitor customers’ transactions and flag suspicious activities, including complex, unusually large or unusual patterns of transactions. Records of all data, documents and information related to the requirements under the code should be prepared, maintained and retained, the code says. 

ACCESS is compiling feedback from the public on the code until September 10, 2019.

The post Trade Association Proposes Code of Practice for Singapore Cryptocurrency Industry appeared first on Bitcoin Magazine.